Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-21 08:37Z
2025-09-03
2025-09-03 13:15Z
CRIT

CVE-2025-53693 — Sitecore Experience_commerce: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-53693

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4. CVSSv3.1 9.8 (CRITICAL) · EPSS 97th percentile

CWECWE 470VNDSitecoreTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2025-09-03
2025-09-03 13:15Z
HIGH

CVE-2025-53691 — Sitecore Experience_commerce: Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-53691

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4. CVSSv3.1 8.8 (HIGH) · EPSS 76th percentile

CWECWE 502VNDSitecoreTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-03
2025-09-03 09:15Z
HIGH

CVE-2025-2415 — Restriction: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-2415

Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass. This issue affects MyRezzta: from s2.03.01 before v2.05.01. CVSSv3.1 8.6 (HIGH) · EPSS 23th percentile

CWECWE 307TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2025-09-03
2025-09-03 09:15Z
CRIT

CVE-2025-1740 — Restriction: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass, Password

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-1740

Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass, Password Recovery Exploitation, Brute Force. This issue affects MyRezzta: from s2.03.01 before v2.05.01. CVSSv3.1 9.8 (CRITICAL) · EPSS 23th percentile

CWECWE 307TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-03
2025-09-03 07:15Z
CRIT

CVE-2024-32444 — Inspirythemes Realhomes: Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-32444

Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes: from n/a through <= 4.3.6. CVSSv3.1 9.8 (CRITICAL)

CWECWE 266VNDInspirythemesTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-03
2025-09-03 02:15Z
HIGH

CVE-2025-58163 — Freescout Freescout: Versions 1.8.185 and earlier contain a deserialization of untrusted data vulnerability that allows authenticated

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-58163

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.185 and earlier contain a deserialization of untrusted data vulnerability that allows authenticated attackers with knowledge of the application's APP_KEY to achieve remote code execution. The vulnerability is exploited via endpoint, e.g.: `/help/{mailbox_id}/auth/{customer_id}/{hash}/{timestamp}` where the `customer_id` and `timestamp` parameters are processed through the decrypt f CVSSv3.1 8.8 (HIGH) · EPSS 53th percentile

CWECWE 502VNDFreescoutTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-02
2025-09-02 20:15Z
HIGH

CVE-2025-8299 — Realtek Wi-fi_usb_driver: rtl81xx SDK Wi-Fi Driver MgntActSet_TEREDO_SET_RS_PACKET Heap-based Buffer Overflow Local Privilege Escalation Vulnerability.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-8299

Realtek rtl81xx SDK Wi-Fi Driver MgntActSet_TEREDO_SET_RS_PACKET Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Realtek rtl81xx SDK Wi-Fi driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the MgntActSet_TEREDO_SET_RS_PACKET function. The i CVSSv3.1 8.8 (HIGH) · EPSS 4th percentile

CWECWE 122VNDRealtekTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-09-02
2025-09-02 14:15Z
HIGH

CVE-2025-2413 — Restriction: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft ProKuafor allows Authentication Bypass.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-2413

Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft ProKuafor allows Authentication Bypass. This issue affects ProKuafor: from s1.02.08 before v1.02.08. CVSSv3.1 8.6 (HIGH) · EPSS 23th percentile

CWECWE 307TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2025-09-02
2025-09-02 12:15Z
HIGH

CVE-2025-2414 — Restriction: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft OctoCloud allows Authentication Bypass.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-2414

Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft OctoCloud allows Authentication Bypass. This issue affects OctoCloud: from s1.09.03 before v1.11.01. CVSSv3.1 8.6 (HIGH) · EPSS 23th percentile

CWECWE 307TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2025-09-02
2025-09-02 05:15Z
HIGH

CVE-2025-9813 — Tenda Ch22_firmware: The manipulation of the argument samba_userNameSda leads to buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9813

A vulnerability was identified in Tenda CH22 1.0.0.1. This issue affects the function formSetSambaConf of the file /goform/SetSambaConf. The manipulation of the argument samba_userNameSda leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. CVSSv3.1 8.8 (HIGH) · EPSS 57th percentile

CWECWE 120CWECWE 119VNDTendaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-02
2025-09-02 03:15Z
HIGH

CVE-2025-9812 — Tenda Ch22_firmware: Executing manipulation of the argument cmdinput can lead to buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9812

A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Executing manipulation of the argument cmdinput can lead to buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. CVSSv3.1 8.8 (HIGH) · EPSS 50th percentile

CWECWE 120CWECWE 119VNDTendaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-02
2025-09-02 01:15Z
HIGH

CVE-2025-57808 — Esphome Esphome_firmware: This allows access to web_server functionality (including OTA, if enabled) without knowing any information

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-57808

ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patche CVSSv3.1 8.1 (HIGH) · EPSS 76th percentile

CWECWE 303VNDEsphomeTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-09-01
2025-09-01 19:15Z
HIGH

CVE-2025-9791 — Tenda Ac20_firmware: This manipulation of the argument wanMTU causes stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9791

A weakness has been identified in Tenda AC20 16.03.08.05. This vulnerability affects unknown code of the file /goform/fromAdvSetMacMtuWan. This manipulation of the argument wanMTU causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. CVSSv3.1 8.8 (HIGH) · EPSS 56th percentile

CWECWE 787CWECWE 121CWECWE 119VNDTendaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-01
2025-09-01 15:15Z
HIGH

CVE-2025-9783 — Totolink A702r_firmware: Executing manipulation of the argument submit-url can lead to buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9783

A vulnerability was determined in TOTOLINK A702R 4.0.0-B20211108.1423. This issue affects the function sub_418030 of the file /boafrm/formParentControl. Executing manipulation of the argument submit-url can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. CVSSv3.1 8.8 (HIGH) · EPSS 50th percentile

CWECWE 120CWECWE 119VNDTotolinkTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-01
2025-09-01 14:15Z
HIGH

CVE-2025-9782 — Totolink A702r_firmware: Performing manipulation of the argument submit-url results in buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9782

A vulnerability was found in TOTOLINK A702R 4.0.0-B20211108.1423. This vulnerability affects the function sub_4466F8 of the file /boafrm/formOneKeyAccessButton. Performing manipulation of the argument submit-url results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used. CVSSv3.1 8.8 (HIGH) · EPSS 50th percentile

CWECWE 120CWECWE 119VNDTotolinkTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-01
2025-09-01 14:15Z
HIGH

CVE-2025-9781 — Totolink A702r_firmware: Such manipulation of the argument ip6addr leads to buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9781

A vulnerability has been found in TOTOLINK A702R 4.0.0-B20211108.1423. This affects the function sub_4162DC of the file /boafrm/formFilter. Such manipulation of the argument ip6addr leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. CVSSv3.1 8.8 (HIGH) · EPSS 50th percentile

CWECWE 120CWECWE 119VNDTotolinkTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-01
2025-09-01 13:15Z
HIGH

CVE-2025-9780 — Totolink A702r_firmware: This manipulation of the argument mac causes buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9780

A flaw has been found in TOTOLINK A702R 4.0.0-B20211108.1423. Affected by this issue is the function sub_419BE0 of the file /boafrm/formIpQoS. This manipulation of the argument mac causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. CVSSv3.1 8.8 (HIGH) · EPSS 50th percentile

CWECWE 120CWECWE 119VNDTotolinkTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-01
2025-09-01 13:15Z
HIGH

CVE-2025-9779 — Totolink A702r_firmware: The manipulation of the argument ip6addr results in buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9779

A vulnerability was detected in TOTOLINK A702R 4.0.0-B20211108.1423. Affected by this vulnerability is the function sub_4162DC of the file /boafrm/formFilter. The manipulation of the argument ip6addr results in buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. CVSSv3.1 8.8 (HIGH) · EPSS 50th percentile

CWECWE 120CWECWE 119VNDTotolinkTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-01
2025-09-01 13:15Z
HIGH

CVE-2025-2412 — Restriction: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft QR Menu allows Authentication Bypass.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-2412

Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft QR Menu allows Authentication Bypass. This issue affects QR Menu: from s1.05.07 before v1.05.12. CVSSv3.1 8.6 (HIGH)

CWECWE 307TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2025-09-01
2025-09-01 13:15Z
HIGH

CVE-2025-0610 — Site: Cross-Site Request Forgery (CSRF) vulnerability in Akınsoft QR Menü allows Cross Site Request Forgery.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-0610

Cross-Site Request Forgery (CSRF) vulnerability in Akınsoft QR Menü allows Cross Site Request Forgery. This issue affects QR Menü: from s1.05.06 before v1.05.12. CVSSv3.1 8.6 (HIGH) · EPSS 11th percentile

CWECWE 352TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2025-08-31
2025-08-31 22:15Z
HIGH

CVE-2025-9748 — Tenda Ch22_firmware: Executing manipulation of the argument ipsecno can lead to stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9748

A vulnerability was determined in Tenda CH22 1.0.0.1. Affected by this issue is the function fromIpsecitem of the file /goform/IPSECsave of the component httpd. Executing manipulation of the argument ipsecno can lead to stack-based buffer overflow. The attack may be performed from remote. CVSSv3.1 8.8 (HIGH) · EPSS 57th percentile

CWECWE 787CWECWE 121CWECWE 119VNDTendaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-08-31
2025-08-31 21:15Z
MED

CVE-2025-9745 — Dlink Di-500wf_firmware: The manipulation of the argument path leads to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9745

A security vulnerability has been detected in D-Link DI-500WF 14.04.10A1T. The impacted element is an unknown function of the file /version_upgrade.asp of the component jhttpd. The manipulation of the argument path leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. CVSSv3.1 4.7 (MEDIUM) · EPSS 96th percentile

CWECWE 77CWECWE 78VNDDlinkTYPVulnerability
4.7
CVSS v3.1
77
Edit Score
2025-08-31
2025-08-31 04:15Z
HIGH

CVE-2025-47696 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-47696

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through <= 3.4.7. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-08-31
2025-08-31 04:15Z
CRIT

CVE-2025-31100 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in Mojoomla School Management school-management allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-31100

Unrestricted Upload of File with Dangerous Type vulnerability in Mojoomla School Management school-management allows Upload a Web Shell to a Web Server.This issue affects School Management: from n/a through <= 1.93.1 (02-07-2025). CVSSv3.1 9.9 (CRITICAL)

CWECWE 434TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2025-08-31
2025-08-31 04:15Z
CRIT

CVE-2024-32832 — Authorization: Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-32832

Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.6.93. CVSSv3.1 9.8 (CRITICAL)

CWECWE 862TYPVulnerability
9.8
CVSS v3.1
99
Edit Score